Either content elements or shadow elements should not be treated as insertion points if they are no…

Source/core/dom/shadow/InsertionPoint.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 125 matching lines @@
         return false;
     for (Node* node = parentNode(); node; node = node->parentNode()) {
         if (node->isInsertionPoint())
             return false;
     }
     return true;
 }
 
 bool InsertionPoint::isActive() const
 {
+    if (!inDocument())
+        return false;
     if (!canBeActive())
         return false;
     ShadowRoot* shadowRoot = containingShadowRoot();
-    if (!shadowRoot)
-        return false;
+    ASSERT(shadowRoot);
     if (!hasTagName(shadowTag) || shadowRoot->descendantShadowElementCount() <= 1)
         return true;
 
     // Slow path only when there are more than one shadow elements in a shadow tree. That should be a rare case.
     const Vector<RefPtr<InsertionPoint> >& insertionPoints = shadowRoot->descendantInsertionPoints();
     for (size_t i = 0; i < insertionPoints.size(); ++i) {
         InsertionPoint* point = insertionPoints[i].get();
         if (point->hasTagName(shadowTag))
             return point == this;
     }
@@ skipping 140 matching lines @@
         if (!insertionPoints)
             return;
         for (size_t i = 0; i < insertionPoints->size(); ++i)
             results.append(insertionPoints->at(i).get());
         ASSERT(current != insertionPoints->last().get());
         current = insertionPoints->last().get();
     }
 }
 
 } // namespace WebCore